RouterOS Knowledge Base

What is MikroTik?

MikroTik is a Latvian company that develops network hardware and software. Their products are used by Internet Service Providers (ISPs), network administrators, and businesses to manage connectivity, security, and network performance. MikroTik devices are known for being affordable, highly flexible, and packed with enterprise-grade features, making them suitable for various network environments.

What is RouterOS?

RouterOS is MikroTik’s operating system, powering all their routers and network devices. It offers a wide range of networking features, including:

• Networking & Routing: Supports static and dynamic routing.

• Firewall & Security: Includes packet filtering, NAT, and DDoS protection.

• Wireless & Hotspot: Allows AP mode, client mode, and wireless mesh setups.

• Bandwidth Management: Uses queueing and traffic shaping to optimize network usage.

• VPN & Remote Access: Supports PPTP, L2TP, OpenVPN, and IPsec VPN.

• Load Balancing & Failover: Ensures network redundancy and reliability.

• Network Monitoring & Logging: Provides tools for troubleshooting and performance optimization.

RouterOS also offers key features like command line and GUI access (via CLI, WinBox, or WebFig), robust firewall and security tools, traffic control through bandwidth management, VPN support for secure remote access, wireless management for AP or mesh networks, dynamic routing (OSPF, BGP, RIP), hotspot and captive portal functionality, and logging and monitoring tools for better network insights.

MikroTik Hardware Overview

MikroTik provides a variety of hardware devices, such as:

• RouterBOARD Series: Standalone routers with different capabilities.

• Cloud Core Routers (CCR): High-performance routers for large networks.

• Cloud Smart Switches (CSS): Managed switches with VLAN and QoS features.

• hAP Series: Compact routers for home or office use with wireless support.

• LHG & SXT Series: Wireless devices for long-range connectivity.

• RB Series: Versatile routers for ISPs and enterprise networks.

RouterOS Licensing & Updates

RouterOS has different licensing levels, each offering specific features:

• Level 3: Basic routing and wireless client mode.

• Level 4: Adds wireless AP support.

• Levels 5 & 6: Include advanced routing and enterprise features.

To update RouterOS, follow these steps:

1. Check your current version by going to System > Packages.

2. Download the latest version from the MikroTik website.

3. Upload the new package to your router using WinBox or FTP.

4. Reboot your device to complete the update.

MikroTik routers can be accessed through different methods, including WinBox (GUI), WebFig (browser-based GUI), and CLI (Command Line Interface). This guide will walk you through the different ways to access your MikroTik router.

Access Methods

1. Using WinBox

1. Download WinBox from the MikroTik website.

2. Connect your PC to the MikroTik router using an Ethernet cable.

3. Open WinBox and click Neighbors to detect your router.

4. Select the router’s MAC address or IP address.

5. Enter Username (default: admin) and leave the password blank (if not set).

6. Click Connect.

Note: On some newer models, the default login credentials are printed on the bottom of the router.

2. Using WebFig (Browser GUI)

1. Connect your PC to the MikroTik router.

2. Open a browser and enter http://192.168.88.1 (default IP).

3. Log in with the default credentials (Username: admin, Password: blank).

4. You will now have access to the WebFig interface.

3. Using CLI (Telnet, SSH, Console)

1. Telnet/SSH Access:

   • Use a terminal or PuTTY and enter:

     ssh admin@192.168.88.1

   • Press Enter and input credentials if prompted.

2. Console Access:

   • If using a serial connection, open a terminal and connect via serial settings (115200 baud rate).

Best Practices

• Change the default login credentials for security.

• Use WinBox for an easier graphical configuration experience.

Summary:
Quick Set allows beginners to configure their MikroTik router easily by setting up internet access, LAN IP, DHCP, and Wi-Fi in just a few steps.

Accessing Quick Set via WinBox or WebFig

Step-by-step using WinBox:

1. Connect your PC to the MikroTik router via Ethernet.

2. Open WinBox and log in using:

   • Username: admin

   • Password: (blank by default)

3. Click on the Quick Set button in the top-left menu.

Configuration Options in Quick Set

The Quick Set interface may vary depending on your router model (e.g., HomeAP, CPE), but generally includes the following:

1. Internet Setup

• Address Acquisition: Choose DHCP, Static, or PPPoE (for DSL or fiber connections).

• PPPoE: Enter your ISP-provided username and password if needed.

• DNS: Optionally set custom DNS servers (e.g., 8.8.8.8 and 8.8.4.4).

2. Local Network

• IP Address: The default is 192.168.88.1. You can change this based on your network.

• Netmask: Leave as 24 (255.255.255.0).

• DHCP Server: Ensure this is enabled so your devices can automatically get IP addresses.

3. Wireless (for Wi-Fi models only)

• SSID: Enter your desired Wi-Fi network name.

• Password: Set a strong wireless password.

• Country: Set your country to comply with local wireless regulations.

4. Admin Settings

• Admin Password: Set a strong new password to replace the default blank.

IMPORTANT: Always change the default admin password immediately to secure your device.

Apply the Configuration

Click Apply Configuration or Apply Settings. Your router will save and activate the configuration immediately.

Reconnecting After IP Change

If you changed the router’s IP address (e.g., from 192.168.88.1 to 192.168.1.1), you’ll need to reconnect to the new address in WinBox or your browser.

TIP:
After the Quick Set process, switch to the full WebFig or WinBox interface to access advanced features like VLANs, firewall rules, and VPN settings.

Summary:
Assigning a static IP address to your MikroTik router is essential for consistent management, especially in larger networks, server environments, or when using port forwarding and VPNs.

Method 1: Set a Static IP via WinBox

Step-by-step using WinBox:

1. Connect your PC to the router using Ethernet.

2. Open WinBox and log in using:

   • Username: admin

   • Password: (blank or your custom password)

3. Go to IP > Addresses from the left menu.

4. Click the "+" button to add a new address.

5. Enter your desired static IP in the Address field (e.g., 192.168.1.1/24).

6. In the Interface field, choose the interface you want to assign the IP to (e.g., ether1, bridge).

7. Click Apply, then OK.

IMPORTANT: Do not assign a static IP that conflicts with an existing DHCP range.

Method 2: Set a Static IP via CLI (Terminal)

1. Open WinBox and click the Terminal button

   • Or connect using SSH: ssh admin@192.168.88.1

2. Type the following command:

Replace 192.168.1.1/24 with your desired IP/subnet, and ether1 with the correct interface.

TIP: To view existing IP addresses, use:

Optional: Disable the Default DHCP Client (If Needed)

If your router is using DHCP to get its current IP, disable it to avoid conflicts:

1. Go to IP > DHCP Client

2. Select the entry bound to the same interface

3. Click Disable

Or via CLI:

Test the Static IP Address

• After applying the new static IP, disconnect and set your PC to the same IP range.

• Access the router at the new IP via WinBox or browser (e.g., 192.168.1.1).

IMPORTANT: If you cannot access the router after changing the IP, reset your PC’s IP settings or use MAC address login via WinBox.

Summary:
Upgrading your MikroTik RouterOS ensures better performance, access to new features, and security patches. This guide walks you through upgrading using WinBox.

Step 1: Connect to Your MikroTik Router

1. Open WinBox and log in using:

   • Username: admin

   • Password: (your configured password)

2. Connect via IP address or MAC address.

3. If you changed your router’s IP, use the new one (e.g., 192.168.1.1).

Step 2: Check Your Current RouterOS Version

1. In WinBox, go to System > Packages

2. You’ll see your current RouterOS version and installed packages.

Step 3: Open the Upgrade Tool

1. Go to System > RouterOS Upgrade

2. Click Check For Updates

3. Choose the Channel (usually stable is recommended)

4. If a new version is available, it will show up

Step 4: Download and Install the Update

1. Click Download & Install

2. The router will:

   • Download the firmware

   • Automatically reboot when the process is complete

TIP: The router may be unreachable for a minute or two during reboot. Wait until the LED indicators stabilize or WinBox shows it again.

Optional: Upgrade RouterBOARD Firmware

After the main RouterOS upgrade:

1. Go to System > RouterBOARD

2. Click Upgrade

3. Click OK, then reboot the router manually

Or via CLI:

Important Reminders:

• Always back up your config before any upgrade

• Avoid upgrading during peak hours or when the router is in production use

• Make sure your PC stays powered and connected during the process

Summary:
Creating a backup of your MikroTik router ensures you can easily restore configurations in case of failure, reset, or migration. MikroTik offers both binary backup files and export scripts.

Method 1: Back Up Using WinBox (.backup file)

To create a backup:

1. Open WinBox and log in:

   • Username: admin

   • Password: your configured password

2. Go to Files from the left panel

3. Click Backup at the top

4. Set a file name (e.g., config.backup) and optionally a password

5. Click Backup

A new .backup file will appear in the Files window. Right-click and choose Download to save it to your PC.

IMPORTANT: .backup files are device-specific and can’t be restored on other models.

To restore a backup:

1. Go to Files, and upload your .backup file (drag and drop or click Upload)

2. Select the file and click Restore

3. The router will reboot and restore the configuration

Method 2: Export Configuration to Script (.rsc file)

To export configuration as a readable script:

1. Go to New Terminal in WinBox

2. Type:

1. Go to Files, and download config.rsc to your PC

This file can be edited, reused, or restored on similar models.

To import/export via CLI:

• Export:
  /export file=config

   

• Import:
  /import file-name=config.rsc

TIP: Use this method to migrate configs between compatible MikroTik devices.

Best Practices:

• Create both .backup and .rsc files for full redundancy

• Always back up before upgrades or major changes

• Store files securely and label them clearly with date/model

• For sensitive deployments, encrypt the .backup file with a strong password

Summary:
Resetting your MikroTik router to factory settings erases all configurations and returns the device to its original state. This is useful for troubleshooting, reconfiguring, or starting fresh.

Method 1: Soft Reset via WinBox or WebFig

To reset using WinBox:

1. Open WinBox and log in:

   • Username: admin

   • Password: (your configured password)

2. Go to System > Reset Configuration

3. Choose your reset options:

   • Keep Users: keeps user accounts

   • No Default Configuration: resets but leaves the router blank

4. Click Reset Configuration

5. The router will reboot and return to default settings

Default IP after reset: 192.168.88.1
Username: admin
Password: (blank)

Method 2: Hard Reset Using the Reset Button

To perform a physical reset:

1. Power off the MikroTik router

2. Press and hold the Reset button

3. Power on the device while still holding the button

4. Keep holding until the ACT light blinks or LED behavior indicates reset (about 5–15 seconds)

5. Release the button and wait for reboot

IMPORTANT: This erases all settings. After reset, use WinBox or Web browser to access the router at 192.168.88.1.

Method 3: Reset Using Netinstall (Advanced Recovery)

If the router is unresponsive or won’t boot correctly, you can use MikroTik’s Netinstall tool.

• Requires a PC with Ethernet port, Netinstall software, and router in bootloader mode

• Best for recovery from misconfiguration or RouterOS corruption

• You can reinstall RouterOS and reset the configuration at the same time

TIP: Use this only if the soft and hard reset options don’t work.

Post-Reset Steps

1. Set your PC IP to 192.168.88.2

2. Access the router via WinBox or browser at 192.168.88.1

3. Log in using admin and set a new password

4. Run Quick Set or restore a backup if available

Summary:
One of the most important first steps after logging into your MikroTik router is to change the default admin password. This helps secure your device against unauthorized access.

Why This Is Important

• MikroTik routers often ship with the default login:

  • Username: admin

  • Password: (blank) 

  • If unchanged, anyone on your network can access your router

IMPORTANT: Always set a strong, secure password during initial setup.

Method 1: Change Password via WinBox

1. Open WinBox and connect to your router

2. Go to System > Users

3. Select the admin user

4. Click Password

5. Enter your Old Password (leave blank if it’s the first login)

6. Enter a New Password and confirm it

7. Click OK

TIP: Use a complex password with a mix of letters, numbers, and symbols.

Method 2: Change Password via WebFig

1. Open your browser and go to http://192.168.88.1

2. Login with admin and current password

3. Navigate to System > Users

4. Select admin, then click Set Password

5. Save your changes

Method 3: Change Password via CLI / Terminal

1. Open Terminal in WinBox or SSH into the router:
   ssh admin@192.168.88.1

2. Run the following command:

Replace YourNewSecurePassword with your chosen password.

Best Practices:

• Do not reuse passwords from other systems

• Avoid short or dictionary-based words

• Update the password regularly

• Remove or disable unused accounts under System > Users

Summary:
Creating separate user accounts with limited permissions is a smart way to delegate tasks without giving full access. MikroTik allows you to define user roles for better security and control.

Default Access Behavior

• By default, only the admin account exists, with full permissions.

• It's best to avoid sharing the admin login and instead create unique users with defined roles.

Step-by-Step: Create a New User via WinBox

1. Open WinBox and log in using admin credentials.

2. Go to System > Users

3. Click the "+" button to add a new user

4. Fill out the following:

   • Name: Desired username (e.g., techsupport)

   • Group: Choose read, write, or full

   • Password: Enter a secure password for the user

5. Click Apply and then OK

Group Roles:

• read – Can view settings but not make changes

• write – Can make most changes but can’t alter system-wide settings

• full – Same as admin privileges

IMPORTANT: Avoid giving unnecessary full access to staff or clients.

To Create a New User via CLI (Terminal)

1. Open Terminal in WinBox or connect via SSH

2. Enter the following command:

   /user add name=techsupport group=read password=SecurePass123

Replace techsupport with your desired username, and SecurePass123 with a strong password.

To List All Users via CLI

To Remove a User via CLI

Best Practices:

• Create a separate user for each technician or team member

• Assign the read group to those who only need monitoring access

• Regularly review and remove unused accounts under System > Users

• Always use strong passwords for all users

Summary:
Properly securing your MikroTik router is essential to protect your network from unauthorized access, exploitation, and configuration tampering. Here are basic security practices every user should implement.

1. Change the Default Admin Password

Never keep the default login:

• Username: admin

• Password: (blank)

Change it immediately after the first login to a strong password.

To change it:
System > Users > admin > Password

Or via Terminal:

2. Disable Unused Services

Reduce attack surface by disabling services you don’t use:

1. Go to IP > Services

2. Disable unnecessary services like ftp, telnet, or www

Or via CLI:

TIP: Keep only what you use (e.g., winbox, ssh, api, or www-ssl).

3. Limit Access to Trusted IPs

Restrict remote management to specific IPs:

1. Go to IP > Services, double-click a service (e.g., winbox)

2. In Available From, enter allowed IP range (e.g., 192.168.1.0/24)

Or via CLI:

4. Create Non-Admin Users

Don’t share the admin account. Create user-specific accounts with appropriate roles (read, write, full).

Example:

5. Enable Basic Firewall Protection

Block unwanted traffic from the internet:

TIP: Adjust ether1 to match your WAN interface.

6. Keep RouterOS Updated

• Use System > Packages > Check for Updates

• Click Download & Install

Stay on the stable channel unless you need specific features.

7. Backup Your Config Regularly

Use .backup and .rsc files to prevent data loss in case of failure.

8. Disable MAC Server on WAN Interfaces

Prevent WinBox MAC access from the internet:

Go to Tools > MAC Server > Interface, and uncheck your WAN ports.

9. Monitor Logs and Login Attempts

Check logs regularly under Log or via:

10. Use Strong Passwords and Rotate Them

Avoid simple or reused passwords. Use a secure password manager if needed.